Maybe article 22 (“automated individual decision-making, including profiling”) can be useful here, too. This will not work if the account is not nominative though.